Low Degree Test with Polynomially Small Error

Dana Moshkovitz ∗

January 31, 2016

Abstract

A long line of work in Theoretical Computer Science shows that a function is close to alow degree polynomial iff it is locally close to a low degree polynomial. This is known as lowdegree testing, and is the core of the algebraic approach to construction of PCP.

We obtain a low degree test whose error, i.e., the probability it accepts a function thatdoes not correspond to a low degree polynomial, is polynomially smaller than existing lowdegree tests. A key tool in our analysis is an analysis of the sampling properties of theincidence graph of degree-k curves and k′-tuples of points in a finite space Fm.

We show that the Sliding Scale Conjecture in PCP, namely the conjecture that there arePCP verifiers whose error is exponentially small in their randomness, would follow from aderandomization of our low degree test.

∗dmoshkov@csail.mit.edu. Department of Electrical Engineering and Computer Science, MIT. This materialis based upon work supported by the National Science Foundation under grants number 1218547 and 1452302.The paper originally appeared as “An Approach to the Sliding Scale Conjecture Via Parallel Repetition For LowDegree Testing” [24].

1

1 Introduction

1.1 Low Degree Test with Polynomially Small Error

A long line of work in Theoretical Computer Science shows that a function is close to a low degreepolynomial iff it is locally close to a low degree polynomial (see, e.g., [19, 31, 4, 29, 20, 9, 27]).This is known as low degree testing, and is the core of the algebraic approach to construction ofPCP, as well as of algebraic constructions of locally testable codes.

In this paper we consider the following formulation of low degree testing, which is conduciveto the applications to PCP and codes. The parameters are a finite field F, and natural numbersm and d. A verifier queries a constant number of non-interacting provers regarding a functionf : Fm → F that is supposedly an m-variate polynomial of degree at most d. For instance, theverifier may ask the provers for the restriction of f to lines, planes, curves, etc. If f is indeeda polynomial of degree at most d, and the provers respond truthfully, then the verifier alwaysaccepts. In contrast, there exists ε0 > 0, such that any prover strategy that the verifier acceptswith non-negligible probability ε ≥ ε0 must correspond to a short list of polynomials of degreeroughly d.

The most important parameter of a low degree test is its “error” ε0. This parameter dominatesthe error probability of the PCP or the locally testable code. Additional parameters that are ofinterest are the randomness complexity of the verifier (i.e., the number of random bits that theverifier uses to generate the queries to the provers) and the answer size of the provers (i.e., thenumber of bits that comprise the answers of the provers). Previous work [4, 29, 27] showed thatthe error can be as low as ε0 = poly(m) · (d/ |F|)Ω(1) with O(m log |F|) randomness complexityand poly(d,m, log |F|) answer size. For a sufficiently large field F (with respect to d and m), the

error is |F|−Ω(1).All low degree tests considered before inherently have error that is larger than |F|−1. A

natural question is whether one can devise a test with lower error, e.g., |F|−k for a parameterk > 1. This is the question that the current paper answers in the affirmative. We prove:

Theorem 1.1 (Low error low degree test; see Lemma 11.2). Assume that F is sufficiently largewith respect to d, m and k (i.e., |F| = poly(m, d, k)). Then, there is a low degree test whose

error probability is |F|−Ω(k). The provers’ answer size is poly(d, k, log |F|), and the randomnessof the verifier is O(km log |F|).

Moreover, since the tester of Theorem 1.1 queries the supposed restriction of the function onconstant-dimensional surfaces, we get the following unusually strong property testing theorem,showing that one can probabilistically, to a very large degree of certainty, decide whether afunction corresponds to a low degree polynomial, even in a very weak sense, by making a smallnumber of queries to the function:

Theorem 1.2 (Property tester). Assume that F is sufficiently large with respect to d, m andk. Then, there is a randomized algorithm that, given f : Fm → F, queries the evaluations of fon poly(|F|) points, and satisfies the following:

• If f is a polynomial of degree at most d, then the algorithm always accepts.

• There are δ = |F|−Θ(k), ε = |F|−Θ(1), such that if f is ε-far from low degree (i.e., there isno polynomial of degree at most dk that agrees with f on at least ε fraction of the pointsx ∈ Fm), then the probability that the algorithm rejects is at least 1− δ.

2

Note that the parameters ε and δ are extremely strong, since every function is 1/ |F|-close to

a constant function, and since δ is significantly lower than the probability 1/ |F|Ω(1) that wasknown before.

We prove Theorem 1.1 by developing a “direct product of low degree tests” to amplify theerror of existing low degree tests (more on this in Section 1.2). Our analysis builds on aprevious work by Imagliazzo, Kabanets and Wigderson [21]. We simplify and strengthen theIKW analysis and significantly improve the parameters it yields in our case. We stress that

a direct application of IKW would have given a 2−Ω(√k) error rather than |F|−Ω(k) error. At

the original time of the paper’s writing, it was not known how to improve IKW’s work to error2−Ω(k). A related theorem with error 2−Ω(k) was obtained by Dinur and Steurer [17] concurrently

with our work. Moreover, it was not known how to have the base of the exponent as |F|−Ω(1)

instead of 2−Ω(1). In the closely related setup of parallel repetition this was eventually obtainedby several works [16, 25, 10]; the earliest of which was concurrent with our work. Our workcombines the advantages of both lines of study.

As we explain in the sequel, our “direct product” is somewhat different than standard directproduct. However, like the original direct product, the randomness complexity of our verifieris O(k) times the randomness complexity of the original verifier. We show that if there were away to implement our tester in a randomness-efficient way, so that the randomness complexitywere O(k log |F|) plus the randomness complexity of the original verifier (note that the error isexponentially small in O(k log |F|)), then one could have resolved the oldest open problem inPCP, known as “The Sliding Scale Conjecture” of Bellare, Goldwasser, Lund and Russell [7].The conjecture is that in PCP with constant number of queries the error can be exponentiallysmall in the randomness of the verifier.

Theorem 1.3 (From low degree test to Sliding Scale Conjecture). If there is a low degree test

with randomness complexity O(m log |F|), answer size poly(d,m, log |F|), and error |F|−Ω(m) (seeConjecture 3.1), then the Sliding Scale Conjecture follows, i.e., there exists c > 0 such that

NP ⊆ PCP1,1/n[O(log n), O(1)][poly(n)],

where PCPc,s[r, q]Σ denotes the class of problems that have a PCP verifier with completeness c,soundness s, randomness r, number of queries q and where the proof is over an alphabet Σ.

For more details about the Sliding Scale Conjecture and its implications, see the previousversion of this paper [24].

We note that a randomness-efficient low degree test obtained by amplifying a low degree testwith higher error as in the current work must avoid known limitations on derandomized parallelrepetition [18, 26]. We believe that this might be possible thanks to the algebraic structure ofthe low degree testing problem.

1.2 Direct Product of Low Degree Tests

In direct product testing a randomized verifier queries a constant number of provers regardinga function s : [n] → Σ they were supposed to agree on. The verifier’s questions are about therestriction of s to different sets A ⊂ [n] (i.e., (s(i) : i ∈ A)). The verifier tests probabilisticallywhether the provers are consistent by comparing the answers of the provers on intersecting sets.If the provers’ responses are consistent with some function s : [n] → Σ, the verifier alwaysaccepts. Moreover, the probability that the verifier accepts when the provers’ responses do not

3

match one of a few functions s1, . . . , sl : [n] → Σ, is small. Direct product testing was introducedby Goldreich and Safra [20] and studied in many works since [15, 13, 21, 17].

In this work, we define an algebraic analogue of direct product testing for low degree testing.Instead of a function s : [n] → Σ, we have a polynomial p of degree at most d over F that theprovers are supposed to agree on. The verifier queries the provers about the supposed restrictionof p to algebraic surfaces of degree k rather than to general sets. The algebraic structure allowsthe verifier to test for low degree. The actual test is a variation of the IKW test. The verifierpicks three curves, where each curve intersects the previous curve in k′ < k/2, k′ = Θ(k)points. The verifier sends different curves and k′-tuples of points to different provers, who aresupposed to respond with the restriction of the polynomial to their sets. The verifier checksconsistency on the intersections. The large intersections enable the error to be exponentiallysmall in k′. Crucially, the third curve is independent of the first curve, which forces the proversto be consistent with a global polynomial over Fm.

Curves Test

1. Pick uniformly and independently at random:

• a degree-k curve c1;

• two k′-tuples of points S0, S1 on c1 such that S0 ∩ S1 = ϕ;

• a degree-k curve c2 that passes through S1;

• a k′-tuple of points S2 contained in c2 such that S1 ∩ S2 = ϕ;

• a degree-k curve c3 that passes through S2;

• a k′-tuple of point S3 contained in c3 such that S2 ∩ S3 = ϕ.

2. Send each of S0, S1, S2, S3, c1, c2, c3 to a different prover.

• For each curve ci the prover sends a univariate polynomial pi of degree at most dkthat is supposed to be the restriction of the polynomial p to ci.

• For each tuple Sj the prover sends assignments aj over F to the points in Sj . Theassignments are supposed to be the evaluations of p on the points.

3. Check that pi(x) = aj(x) for every Sj ⊆ ci and x ∈ Sj .

To prove Theorem 1.1 we end up analyzing a similar test that considers constant-dimensionalsurfacess that span whole lines instead of curves. This way we can directly use earlier worksthat analyze tests based on lines [4].

1.3 The Sampling Properties of Curves and Tuples

A key lemma in the proof of Theorem 1.1, and the main source for the quantitative improvementover IKW, is an analysis of the sampling properties of the incidence graph of “degree-k curvesvs. k′-tuples” (similarly, “degree-k surfaces vs. k′-tuples”). This graph is the bipartite graphthat has on one side all degree-k curves in a space Fm, and on the other side all k′-tuples ofpoints in Fm. A curve is connected to a tuple if it contains it. Let S be a subset of µ fraction ofthe k′-tuples. We say that a curve ε-samples S if µ ± ε fraction of the tuples on the curve arein S. We say that the curves vs. tuples graph is a (δ, ε)-sampler if for any subset S as above atleast 1 − δ fraction of the curves ε-sample S. We call δ the sampling error, and we call ε thedeviation error. We show:

4

Lemma 1.1 (See Corollary 4.5). Let 0 < ε < 1. Then, for all k′, the incidence graph “degree-kcurves vs. k′-tuples” is a (2δ(k′)/ε, 2k′ε)-sampler for

δ(k′) =kk(k + 1)

εk(|F| − k′ + 1)(k−k′+1)/2.

For sufficiently large field F (polynomial size) with respect to k, and sufficiently large k (linear

size) with respect to k′, one gets deviation error ε = |F|−Ω(1) with sampling error δ = |F|−Ω(k).For k′ = 1, it is well known that the “degree-k curves vs. points” graph has sampling error

δ = |F|−Ω(k) and deviation error ε = |F|−Ω(1). This follows from the (k + 1)-wise independenceof degree-k curves. Extending this argument to “degree-k curves vs. k′-tuples” for larger k′

results in a large sampling error δ = |F|−Ω(k/k′). Similarly, it is shown in [21] that the graph “k-tuples vs. k′-tuples” has sampling error δ = exp(−k/k′) with a small constant deviation errorε. The reason for the error exp(−

√k) in [21] is taking k′ =

√k as to balance exp(−k/k′) and

exp(−k′). On the other hand, we show that the “degree-k curves vs. k′-tuples” incidence graph

has sampling error |F|−Ω(k−k′) while maintaining ε = |F|−Ω(1) deviation error (for sufficiently

large field F). This allows us to take k′ = Θ(k), and achieve error |F|−Ω(k) for the repeated test.Our approach to analyzing the sampling properties of “degree-k curves vs. k′-tuples” is to

view the incidence graph of “degree-k curves vs. k′-tuples” as a k′-fold product of the incidencegraph of “degree-k curves vs. points”. With the appropriate choice of product, the samplingerror of the product graph is k′ times the sampling error of the initial graph. Hence, the samplingerror of “degree-k curves vs. k′-tuples” is similar to that of “degree-k curves vs. points”.

The advantage of this abstract view is that one can use our technique to analyze the samplingproperties of general incidence graphs. Interestingly, this approach does not apply to the “k-tuples vs. k′-tuples” incidence graph relevant for [21]. The reason is that the deviation erroraccumulated in the k′ applications of the product builds up, and – unlike in the curves graph –the initial deviation error is not sufficiently low to withstand that.

1.4 The Wide Agreement Lemma

Even with the improved sampling parameters, it is not clear that the analysis of IKW can belifted to low degree testing in a way that proves Theorem 1.1. Briefly, the reason is that IKWrelies on “majority decoding”, while we have to deal with the “list decoding” regime. One of ourmain contributions is replacing the heart of IKW’s analysis – the same part that uses samplers– with a new, stronger, lemma that we call “The Wide Agreement Lemma”.

If our test passes with significant probability, then curves that intersect on k′-tuples of pointsoften agree on their intersection. In contrast, to prove Theorem 1.1, we need to show thatcurves that intersect on a single point often agree on their intersection. In other words, werequire a much wider agreement – not just between curves that have large intersection, buteven among curves that have a small intersection. A-priori it could be that curves that disagreeon an assignment to a point x typically do not share k′-tuples. However, since the incidencegraph that has on one side curves that contain x and on the other side k′-tuples that contain xis a good sampler for every x ∈ Fm, this cannot happen. The Wide Agreement Lemma appearsas Lemma 8.1 in the sequel, and led to the later work [25].

1.5 Abstraction of Arora-Safra Composition

As a side-benefit of our proof of Theorem 1.3, we provide an abstract version of the Arora-Safracomposition as described next.

5

Arora and Safra [3] were the first to suggest the technique of composition to decrease thenumber of queries (or alphabet) of a PCP verifier, leading to the first PCP with constant numberof queries [2]. Since then, every proposed PCP construction (including the current one) usedcomposition. Alas, the Arora-Safra composition was tailored to low degree extensions, and ledto somewhat cumbersome and restricted usage.

In recent years there has been an attempt to formulate abstract composition lemmas that arewidely applicable and lead to modular, easier to understand, constructions. One combinatorialmethod of composition was formulated by Szegedy [32], Dinur and Reingold [15] and Ben-Sassonet al [8]. Their works revealed the advantage of a “robust” PCP construction for composition.Robustness means that in the soundness case, not only that – with significant probability– the verifier rejects, but, in fact, the verifier’s view is far from one that would have beenaccepted. Equivalently, the PCP is a “projection game” (the equivalence between robust PCPsand projection games is spelled out in [14]). A method of composition that preserves lowsoundness error and projection was discovered by Moshkovitz and Raz [28], and abstracted byDinur and Harsha [14].

Interestingly, in contrast to all those composition techniques, the Arora-Safra compositiondoes not require that the PCP being composed is robust. This is actually an advantage, becauserobust PCPs (equivalently, projection games) are harder to construct than general PCPs. Inthe high error regime there are various techniques for “robustization” (see, e.g., [15]), but in thelow error regime we do not know how to transform a general PCP verifier into a robust PCPverifier with a comparable soundness error.

The composition we define (see Section 12.5 for the definition of composition and its analysis)works in the low error regime and does not require that the PCPs being composed are robust(and, appropriately, does not guarantee that the composed PCP is robust).

1.6 Organization

We start with preliminaries regarding error correcting codes, samplers and extractors, incidencegraphs, curves, surfaces and polynomials over a finite space in Section 2. We formalize low degreetesting in Section 3. We analyze the sampling properties of incidence graphs in Section 4. Weprove a base low degree testing theorem in Section 5. We outline our analysis in Section 6, andin the next sections we provide the proof. We show how the Sliding Scale Conjecture followsfrom a derandomized low degree test in Section 12. We discuss ideas for further research inSection 13.

2 Preliminaries

In this section we introduce notions and notation that we use throughout this work, includingerror correcting codes, samplers and extractors, incidence graphs and curves over a finite space.

Throughout this work, k′-tuple means an ordered set of size k′.

2.1 Error Correcting Codes

An (n, k, d)Σ code C is a set of∣∣Σk

∣∣ strings in Σn, where every two different strings x, y ∈ Cagree on at most d of their symbols, i.e.,

| i ∈ [n] |xi = yi| ≤ d.

6

We often associate an encoding function C : Σk → Σn with C. Many times it is useful that theencoding is systematic, i.e., the first k symbols in the encoding C(x) of some x ∈ Σk are thesymbols of x.

The following code construction follows from [1] using standard techniques (concatenation):

Proposition 2.1 (Code construction). For any 0 < δ < 1 and natural number k, there existsan (n, k, (1− δ)n)Σ code where n = O(k/δ2) and |Σ| = O(1/δ2).

The following bound on the number of codewords that can agree with a word follows fromcounting (our Proposition 3.1 uses a similar argument), and is a simplified version of Johnson’sbound [22]:

Proposition 2.2 (List decoding bound). Let C be an (n, k, d)Σ code. For every w ∈ Σn andδ ≥ 2

√1− d/n, there exist at most 2/δ codewords in C that agree on at least δ fraction with w.

2.2 Samplers and Extractors

For a graph G = (V,E) and a vertex v ∈ V , the neighborhood of v in G is NG(v) =u ∈ V | (v, u) ∈ E.

A sampler is a bi-regular bipartite graph with a large part A and a small part B, in which, forany set B′ ⊆ B, almost every vertex in A has about |B′| / |B| fraction of its neighbors landingin B′:

Definition 2.1 (Sampling). For 0 < δ, ε < 1, we say that a bi-regular bipartite graph G =(A,B,E) is a (δ, ε)-sampler if for any set B′ ⊆ B, µ = |B′| / |B|, for a uniformly distributeda ∈ A, it holds that ∣∣∣∣ |NG(a) ∩B′|

|NG(a)|− |B′|

|B|

∣∣∣∣ ≤ ε,

with probability at least 1− δ.

We call δ the sampling error and ε the deviation error.An extractor is a function that maps a distribution X ′ with sufficient “randomness” over

a large space X to a distribution that is approximately uniform over a small space Z. Themapping is probabilistic, and uses an independent uniform “seed” y ∈ Y . The function mapsx ∈ X and y ∈ Y to z ∈ Z and an additional w ∈ W , so (z, w) uniquely defines (x, y). Therandomness of X ′ is measured using min-entropy, and is H∞(X ′) = log(1/maxx Pr [X

′ = x]).

Definition 2.2 (Extractor). A 1-1 function Ext : X × Y → Z × W is a (δ, ε)-extractor iffor any distribution X ′ over X, H∞(|X ′|) ≥ log(δ |X|), the probability distribution defined1 byExt(X ′, Y ) on Z, is ε-close to uniform over Z.

X ′ is called the randomness source. The elements in Y are called the seeds of the extractor.Often extractors are defined without W and without being 1-1, but incorporating W will beuseful for us, and this convention – the “rotation map” of [30] – has been used in the past. Weassociate a bipartite graph with Ext: the graph is on vertices X ∪ Z and it has an edge (x, z)if there are y ∈ Y and w ∈ W such that Ext(x, y) = (z, w). The elements in Y enumerate theneighbors of a vertex in X, while the elements of W enumerate the neighbors of a vertex in Z.

Zuckerman observed that the notions of sampler and extractor are closely related:

1This distribution is sampled by picking uniformly at random x ∈ X ′ and y ∈ Y , computing Ext(x, y) = (z, w),and outputting z.

7

Proposition 2.3 ([34]). The following hold:

1. If Ext : X×Y → Z×W is a (δ, ε)-extractor, then the bipartite graph on X ∪Z associatedwith it is a (2δ, ε)-sampler.

2. If (X,Z,E) is a (δ, ε)-sampler, then a corresponding function Ext : X × Y → Z ×W is,for any δ′ ≥ δ, a (δ′, ε+ δ/δ′)-extractor.

2.3 Curves, Surfaces and Polynomials

Let F be a finite field. Let m, k and r be natural numbers. A degree-k curve in Fm is afunction c : F → Fm such that there exist m univariate degree-k polynomials c1, . . . , cm wherec(t) = (c1(t), . . . , cm(t)). We often associate a curve with its image c(F). A line is a degree-1curve. A dimension-r degree-k surface in Fm is a function s : Fr → Fm such that there exist m r-variate degree-k polynomials s1, . . . , sm where s(t1, . . . , tr) = (s1(t1, . . . , tr), . . . , sm(t1, . . . , tr)).We often associate a surface with its image s(Fr). A curve is a dimension-1 surface.

For T = t1, . . . , tk ⊆ F and 1 ≤ i ≤ k, we use Lagrange interpolation to define IT,i as thedegree-(k − 1) polynomial that is 1 on ti and 0 on T − ti:

IT,i(t).=

∏j∈T−ti(t− tj)∏j∈T−ti(ti − tj)

.

Fixing T = t1, . . . , tk ⊆ F, for every k-tuple of points X = x1, . . . , xk ⊆ Fm we caninterpolate the degree-(k− 1) curve cX that passes through x1, . . . , xk in positions t1, . . . , tk as:

cX(t) =

k∑i=1

xi · IT,i(t).

2.4 Incidence Graphs

In this work we are interested in bipartite graphs that correspond to set inclusion:

Definition 2.3 (Incidence graph). Let U be a set. Let A and B be families of subsets of U . Theincidence graph G(A,B) is the bipartite graph on A and B in which a vertex a ∈ A is connectedto a vertex b ∈ B if b ⊆ a.

A few examples of incidence graphs are:

1. ”k-tuples vs. k′-tuples”: U is a finite set. A is the family of all k-tuples of points in U ,and B is the family of all k′-tuples of points in U .

2. “degree-k curves vs. k′-tuples”: U = Fm for a finite field F and a natural number m. A isthe set of all degree-k curves in Fm; B consists of all k′-tuples of points in Fm.

3. “degree-k curves vs. points”: A special case of “degree-k curves vs. k′-tuples” in whichk′ = 1, so B corresponds to the family of points2 in Fm.

2We will often use the shorthand B = Fm in this case, even though Definition 2.3 talked about B that consistsof subsets.

8

3 Low Degree Testing

Let F be a finite field and let m, v, d and k be natural numbers. In this section we define lowdegree testing for m-variate polynomials of degree at most d over F by querying v-dimensionalsurfaces of degree at most k in Fm, as well as querying k′-tuples of points in Fm. We generalizeto surfaces as opposed to just curves in order to capture existing tests on planes and low-dimensional subspaces. In particular, our surfaces will be spanned by lines and curves, so wecan apply existing analyses of lines tests.

One is advised to think of the parameters as follows:

• |F| is large with respect to d and m. Typically, |F| = poly(d,m).

• We typically take v to be a small constant, possibly 1.

• We typically take k ≤ d.

• We take k′ to be smaller than k, but often of the same order of magnitude as k.

The set of all surfaces that may be queried is denoted C, and the set of k′-tuples that may bequeried is denoted I. In this work I will always be the set of all k′-tuples of points in Fm. Fora set S ⊆ Fm, we denote the set of all surfaces in a family C′ ⊆ C that pass through S by C′

S .Assignments3 to v-dimensional surfaces of degree at most k in Fm are supposedly the restric-

tions of a single m-variate degree-d polynomial to the surface – in which case we say that theyagree with the polynomial – and in any case are v-variate polynomials of degree at most dkover F. Assignments to k′-tuples of points in Fm are supposedly the restrictions of the samem-variate degree-d polynomial to the points – in which case we say that they agree with thepolynomial – and in any case are k′-tuples of values in F.

A low degree test is specified by a verifier that makes a constant number of queries to surfacesand tuples, receives the assignments to the surfaces and tuples, and either accepts or rejects.The randomness of the low degree test is the number of random bits used by the verifier. Wesay that the low degree test has perfect completeness if the verifier always accepts if wheneverit queries a surface or a tuple it gets the restriction of a single m-variate degree-d polynomialover F. All the tests that we consider in this work have perfect completeness. We say that thetester is uniform, if the distribution of each of its queries is uniform over all surfaces in C ortuples in I. All the tests that we consider in this work are uniform.

3.1 Initial Points

Let q < v + k be a natural number. For the application to PCP we allow the embedding ofq-tuples of points in Fm in the surfaces we consider. Initial conditions are given as a collectionof q-tuples of points (xi,1, . . . , xi,q)Mi=1 where xi,1, . . . , xi,q ∈ Fm. Typically, M ≤ |Fm|. Wefix T ⊆ Fv, |T | = q. We say that a family C of surfaces satisfies the conditions at T if eachsurface c ∈ C passes through xi,1, . . . , xi,q at positions T for some 1 ≤ i ≤ M , and each q-tupleis contained this way in the same number of surfaces in C. In PCP constructions the initialconditions are typically concentrated in a small sub-cube in Fm, and the verifier refrains from

3In the context of multi-prover protocols, it is natural to consider several assignments, one for each prover,while in the context of PCP it is natural to consider a single assignment. However, even in the multi-provercontext one can assume without loss of generality that there is only one assignment, provided that the testrandomly picks which prover to query for each query it makes.

9

comparing the surfaces on them. Hence, we adapt our low degree tests as to allow “forbiddenpoints” that the verifier does not use for comparisons:

Definition 3.1 (Forbidden points). Forbidden points are defined by a function Q : C → 2Fv.

For a surface c ∈ C, let c−Q .= c(Fv−Q(c)). For a family of surfaces C, we will use the notation

C−Q to refer toc−Q

∣∣ c ∈ C.

In this work we consider forbidden points where |Q(c)| is the same for all c ∈ C, and we define|Q| to be this number.

3.2 A Variety of Low Degree Testers

The low degree testers that we consider in this work are:

1. Surface-vs.-Surface Test: compares two surfaces that intersect in a k′-tuple. This isa generalization of Curve-vs.-Curve Test.

2. Surface-vs.-Surface-on-Point Test: compares two surfaces that intersect on a k′-tuple, but only on a random point in the k′-tuple.

3. Surfaces Test: compares three surfaces and four k′-tuples on the three surfaces.

Surface-vs.-Surface Test is parameterized by two families of surfaces, C1 and C2, forbid-den points Qi : Ci → 2F, and a family I of tuples. In this tester and in similar testers: If C2 andQ2 are omitted, it should be understood that C2 = C1 and Q2 = Q1.

Surface-vs.-Surface Test(C1, C2, Q1, Q2, I)

1. Pick uniformly c1 ∈ C1; pick S ∈ I uniformly such that S ⊆ c−Q11 ; pick c2 ∈ C2 uniformly

such that S ⊆ c−Q22 .

2. Check that A(c1)(x) = A(c2)(x) for every x ∈ S.

When the surfaces are one dimensional, we refer to the test as Curve-vs.-Curve Test. Whenthe curves are lines, we refer to the test as Line-vs.-Line Test. Surface-vs.-Surface-on-Point Test is similar to Surface-vs.-Surface Test, except that it only compares the twosurfaces on a random point in their intersection. It is mainly useful an auxiliary test for theanalysis:

Surface-vs.-Surface-on-Point Test(C1, C2, Q1, Q2, I)

1. Pick uniformly c1 ∈ C1; pick S ∈ I uniformly such that S ⊆ c−Q11 ; pick c2 ∈ C2 uniformly

such that S ⊆ c−Q22 .

2. Pick uniformly at random a point x ∈ S.

3. Check that A(c1)(x) = A(c2)(x).

When the intersections between curves are points (i.e., I = Fm, k′ = 1), Surface-vs.-Surface-on-Point Test and Surface-vs.-Surface Test are equivalent. Surfaces Test queriesthree surfaces from a family C with forbidden points Q : C → 2F, and four k′-tuples from afamily I.

10

Surfaces Test(C, Q, I)

1. Pick uniformly and independently at random a surface c1 ∈ C, tuples S0, S1 ∈ I, S0, S1 ⊆c−Q1 , S0 ∩ S1 = ϕ, a surface c2 ∈ C, S1 ⊆ c−Q

2 , a tuple S2 ∈ I, S2 ⊆ c−Q2 , S1 ∩ S2 = ϕ, a

surface c3 ∈ C, S2 ⊆ c−Q3 , and a tuple S3 ⊆ c−Q

3 , S3 ∈ I, S2 ∩ S3 = ϕ.

2. Check that A(c1) agrees on S0 with A(S0); A(c1) and A(c2) agree on S1 with A(S1);A(c2) and A(c3) agree on S2 with A(S2); A(c3) agrees on S3 with A(S3).

One could consider a variant of Surfaces Test that queries only curves and not k′-tuples, butthe test we defined is easier to analyze, and hence we prefer it.

3.3 Low Degree Testing Theorems: Proximity and List Decoding

Let ε > 0 be a function of |F|, d and m (typically ε ≈ d/ |F|). Let d′ be a natural number(typically d′ ≈ d). There are several soundness guarantees we consider for low degree tests:

• Surface (Tuple) Proximity: Let γ′ : [0, 1] → [0, 1] (typically, γ′(γ) = γ − ε). For everyγ ≥ ε, if the verifier accepts with probability γ, then there exists an m-variate polynomialof degree at most d′ over F that agrees with γ′ = γ′(γ) fraction of the surfaces in C (resp.,tuples in I). To denote that this statement holds we write AgrErrCγ→γ′,d→d′(Test) ≤ ε

(resp., AgrErrIγ→γ′,d→d′(Test) ≤ ε).

• Surface (Tuple) List decoding: Let l : [0, 1] → N (typically, l(γ) = O(1/γ)). For everyγ ≥ ε, there exist m-variate polynomials p1, . . . , pl, l = l(γ), of degree at most d′ overF such that the probability that the verifier accepts yet the assignments to the surfaces(resp., tuples) it picked do not agree with one of p1, . . . , pl, is at most γ. To denote thatthis statement holds we write ListErrCl,d′(Test) ≤ ε (resp., ListErrIl,d′(Test) ≤ ε).

It is straightforward to show that a low degree testing theorem in list decoding form impliesa theorem in proximity form, since one of the polynomials in the list has to agree with at leastγ′(γ)

.= (γ− ε)/l(γ) fraction of the tuples. Next we show that the other direction holds as well,

i.e., from a low degree testing in proximity form, one can deduce the list decoding form. Belowwe outline the argument for tuples, since this is what we will use later.

First, we need the following proposition which uses the error correction properties of polyno-mials, and the sampling properties of the family of all k′-tuples of points in Fm. The Propositionextends Proposition 2.2.

Proposition 3.1 (Short list decoding). For δ0 = (d′/ |F|)k′ , for every assignment A of elementsin Fk′ to tuples in I, and any δ ≥ 2

√δ0, there are at most 2/δ m-variate polynomials p1, . . . , pl

of degree at most d′ over F, such that

PrS∈I

[A(S) ≡ p|S

]> δ.

Proof. Assume on way of contradiction that there are different m-variate polynomials p1, . . . , plof degree at most d′ over F with Prc∈C

[A(c) ≡ p|c

]> δ for l = 1 + ⌊2/δ⌋.

For 1 ≤ i < j ≤ l, the polynomials pi and pj can agree on at most d′/ |F| fraction of thepoints in Fm. For at most δ0 = (d′/ |F|)k′ fraction the tuples, the polynomials pi and pj agreeon the tuple.

11

By inclusion-exclusion, the number of tuples that agree with one of p1, . . . , pl can be lowerbounded by:

lδ |I| −(l

2

)δ0 |I| .

We have lδ > 2 and(l2

)≤ 1/δ0, which implies that |I| > |I| – contradiction!

Proposition 3.2 (Proximity ⇒ List decoding). Let δ′ = γ′(δ) − |F|−k′ . Assume that δ′ ≥2(d′/ |F|)k′/2. Then, for any low degree tester Test,

AgrErrIγ→γ′,d→d′(Test) ≤ δ ⇒ ListErrI2/δ′,d′(Test) ≤ δ

Proof. Let δ∗ = γ′(δ). Let δ′ = δ∗ − |F|−k′ , so δ′ ≥ 2(d′/ |F|)k′/2. Let p1, . . . , pl be all them-variate polynomials of degree at most d over F that agree with A on at least δ′ fraction of thetuples S ∈ I. By Proposition 3.1, we have l ≤ 2/δ′. We will upper bound by δ the probabilitythat the test passes, yet the verifier picks S ∈ I such that A(S) /∈

p1|S , . . . , pl|S

(this will

imply the lemma). Assume, toward a contradiction, that this is not the case.For every tuple S ∈ I such that A(S) ∈

p1|S , . . . , pl|S

, define A∗(S) to be a random

element in Fk′ . By our assumption, the probability that Test passes for A∗ is at least δ. SinceAgrErrIγ→γ′,d→d′(Test) ≤ ε, there is an m-variate polynomial p∗ of degree at most d′ over Fthat agrees with A∗ on at least γ′(δ) = δ∗ fraction of the tuples S ∈ I. The probability that

A∗(S) = p∗|S on those tuples S for which A∗(S) was chosen randomly is |F|−k′ , and thus p∗ must

agree with A on at least δ∗−|F|−k′ = δ′ fraction of the tuples. Thus p∗ ≡ pj for some 1 ≤ j ≤ l,and pj agrees with A∗ with probability at least δ′ over the tuples. This is a contradiction!

3.4 A Theorem And A Conjecture

In this work we give the first low degree test whose soundness error can be made |F|−k forarbitrarily large k ≥ 1. The low degree testing theorem follows from applying our direct producttheorem (Theorem 6.1) on the low degree testing theorem in Section 5. The family of surfacesused is specified in Section 5 as well.

Theorem 3.1 (Low error low degree testing theorem). Let F be a finite field that is large enough(polynomial size) with respect to m, k′, q and d, and fix initial conditions (xi,1, . . . , xi,q)Mi=1 ⊆(Fm)q. Then, there is a family C of surfaces, |C| ≤ M |F|O(mk′), that satisfies the initial condi-tions with forbidden points Q : C → 2F; in which the surfaces are of degree k = Θ(k′ + q) anddimension v = O(1); and it holds:

ListErrC|F|O(k′),dk

(Surfaces Test(C, Q, (Fm)k′)) ≤ |F|−Ω(k′) .

We conjecture that there is a low degree test whose soundness error can be made ≈ 1/ |Fm|when the randomness is only O(m log |F|) (note that the verifier can only access a numberof curves and tuples that is exponential in its randomness). As we show in Section 12, theconjecture would imply the Sliding Scale Conjecture:

Conjecture 3.1 (Derandomized low degree test conjecture). Let F be a finite field that is largeenough (polynomial size) with respect to m, k′, q and d, and fix initial conditions (xi,1, . . . , xi,q)Mi=1 ⊆(Fm)q. Then, there exist:

12

1. A family C of surfaces that satisfies the initial conditions, and in which the surfaces areof degree k = poly(k′, q, d) and dimension v = O(1);

2. A family I of k′-tuples of points in Fm;

3. A low degree tester Test that uses O((m+ k′) log |F|+ logM) random bits to make O(1)queries to C and I, so

ListErrC|F|O(k′),poly(d,k)

(Test) ≤ |F|−Ω(k′) .

4 Curve-Tuple Sampling

In this section we explore the sampling properties of the “degree-k curves vs. k′-tuples” (k > k′)incidence graph4. This argument yields low sampling error for k′ = Θ(1). Then, we show thatthe “degree-k curves vs. k′-tuples” graph can be viewed as a k′-product of the “degree-k curvesvs. 1-tuples”. We use this connection to argue that the graph for k′-tuples has essentially thesame sampling error as the graph for 1-tuples, albeit with larger deviation.

Interestingly, while the larger deviation is too large for the “k-tuples vs. k′-tuples” graph (thegraph relevant to IKW [21]), it is sufficiently small when k-tuples are replaced with degree-kcurves.

4.1 The k/k′-wise Independence Argument

Let B ⊆ (Fm)k′, |B| = µ

∣∣∣(Fm)k′∣∣∣. Pick c ∈ C uniformly at random. For a k′ tuple T =

t1, . . . , tk′ ⊆ F, let XT indicate whether (c(t1), . . . , c(tk′)) ∈ B, and let XT = XT − µ.

Since each k′-tuple appears in the same number of curves, we have E[XT

]= 0. Define X

.=(|F|

k′

)−1∑T⊆F XT .

Proposition 4.1 (l’th Moment). Let 2 ≤ l ≤ k/k′.

E[X l

]≤ |F|−l/2 klµ(l + 1).

Proof.

E[X l

]=

(|F|k′

)−l

·E

∑

T⊆FXT

l

=

(|F|k′

)−l

·E

∑T1,...,Tl⊆F

XT1 · · · XTl

=

(|F|k′

)−l

·∑

T1,...,Tl⊆FE[XT1 · · · XTl

](1)

4Our proof readily extends from curves to surfaces.

13

For every l pairwise disjoint T1, . . . , Tl ⊆ F, we have that XT1 , . . . , XTlare independent. Hence,

if among T1, . . . , Tl ⊆ F there is at least one 1 ≤ i ≤ l such that Ti is disjoint from the other Tj

for j = i, we have

E[XT1 · · · XTl

]= E

[XTi

]·E

[XT1 · · · XTi−1XTi+1 · · · XTl

]= 0.

Therefore, the only terms that survive in (1) are those where every Ti has non-empty intersection

with∪

j =i Tj (for this we need l ≥ 2). Their number is bounded by(|F|k′

)l|F|−l/2 kl, since the

Ti’s pick lk′ ≤ k elements from F with multiplicities, and at least l/2 times the element that ispicked is one of at most k elements. Each term can be bounded by:

E[XT1 · · · XTl

]≤ Pr

[∃iXTi = 1− µ

]· (1− µ) + Pr

[∀iXTi = −µ

](−µ)l

≤ l · µ · 1 + 1 · µ= µ(l + 1).

The proposition follows.

As a corollary we get a proof of the sampling property of G(C, (Fm)k′):

Proposition 4.2. For l ≤ k/k′, the incidence graph G(C, (Fm)k′) is µ |F|−l/2 kl(l + 1)ε−l-

sampling.

Proof. By Markov’s inequality,

Pr[X ≥ ε

]≤ Pr

[X l ≥ εl

]≤

E[X l

]εl

.

The proposition follows from Proposition 4.1.

In the sequel we will also need an analysis of the sampling properties of G(CS , IS) where CSis the family of all the degree-k curves through a small set of points S ⊆ Fm, |S| ≪ k′, andIS is the family of all k′-tuples of points in Fm that contain the points in S. Such an analysisfollows along the same lines as above.

For k′ = 1 we recover the standard upper bound of ≈ |F|−k on the sampling error of “degree-kcurves vs. points”.

Corollary 4.3. For sufficiently large field |F| = Θ(k), the “degree-k curves vs. points” incidence

graph is an (|F|−Θ(k) , |F|−Θ(1))-extractor.

However, for larger k′ we get a much weaker upper bound of ≈ |F|−l.It is instructive to have an example in mind for when a sampling error of ≈ |F|−l kl occurs:

Example 4.1. Let X ⊆ Fm be a set of points of fraction µ = |X| / |Fm| to be determinedlater; let B ⊆ (Fm)k

′be the family of k′-tuples in which the lexicographically first element lands

in X; let A ⊆ C be the family of degree-k curves in which the first l points according to thelexicographic order land in X. Then the probability mass of B is µ; the probability mass of A isµl; given that c ∈ A and S ⊆ c, S ∈ (Fm)k

′, the probability that S ∈ B is5 ≈ lk′/ |F|. Pick µ so

µ < lk′/ |F| − ε. The sampling error is roughly (k/ |F| − ε)l.

Note that Example 4.1 works only when ε < lk′/ |F|. For larger ε = |F|−Θ(1) we will be ableto get error ≈ |F|−k rather than ≈ |F|−l in Section 4.2.

5In contrast, for “k-tuples vs. k′-tuples” the probability would have been ≈ lk′/k; the difference is crucial forunderstanding why our approach in Section 4.2 works for the algebraic case, but not for direct products.

14

4.2 Extractor Product

In this section we define a replacement product operation on extractors, and use it to prove amuch lower sampling error for “degree-k curves vs. k′-tuples” than the one proved in Proposi-tion 4.2. Replacement product turns out to have been defined before in [11].

Replacement product is a generalization of a widely-used transformation by Wigderson andZuckerman [33]. Both transformations take two extractors Ext1 and Ext2 and generate a newextractor whose output is the multiplication of the output of Ext1 and the output of Ext2.The new extractor requires independent seeds for Ext1 and Ext2. The difference between ouroperation and the Wigderson-Zuckerman one is that WZ require Ext2 to work for the samedomain as Ext1, and handle a lower min-entropy than Ext1. In our operation the domain ofExt2 is potentially much smaller than the domain of Ext1, and there is no similar demand onthe min-entropy of Ext2. This allows Ext2 to have a smaller seed, and in certain settings mayallow for exhaustive search of a construction of Ext2 with optimal parameters.

Definition 4.1 (Replacement product for extractors). Suppose Ext : X1 × Y1 → Z1 × X2 isan extractor, and Extz : X2 × Y2 → Z2 ×W2z∈Z1

is a family of extractors. Ext ⊗ Extz :X1 × (Y1 × Y2) → (Z1 × Z2) × W2 is defined as follows: assume Ext(x1, y1) = (z1, x2) andExtz1(x2, y2) = (z2, w2), then (Ext⊗ Extz)(x1, y1, y2) = (z1, z2), w2.

The bipartite graph associated with the product extractor can be constructed as follows:Take the bipartite graph associated with Ext1, and replace every vertex z ∈ Z1 with a copy ofthe extractor Ext2, by identifying the Ext1 neighbors of z with elements of X2, and connectingthem to elements in z × Z2 according to Ext2.

The next lemma states that the product of two extractors is also an extractor

Lemma 4.4 (Replacement product lemma). If Ext : X1 ×Y1 → Z1 ×X2 is a (δ1, ε1)-extractorand Extzz∈Z1

: X2 × Y1 → Z2 ×W2 is a family of (δ2, ε2)-extractors, then Ext⊗ Extz is a(δ, ε)-extractor for δ ≥ max δ1, δ2 and ε ≥ ε1 + ε2 + δ2/δ.

Proof. Let X be a distribution over X1 with H∞(X) ≥ log(δ |X1|), and let us show that thedistribution defined by (Ext⊗ Extz)(X,Y1, Y2) over Z1 × Z2 is ε-close to uniform.

Consider z1 ∈ Z1 whose probability according to Ext(X,Y1) is at least (δ2/δ) · (1/ |Z1|). LetXz1 be the distribution over X2 that assigns each x ∈ X2 its probability according to X condi-tioned on z1 being chosen. Since H∞(X) ≥ log(δ |X1|), the probability of any element accordingto Xz1 is at most (1/(δ |X1|)) · (1/ |Y1|) · (δ |Z1| /δ2) = |Z1| /(δ2 |X1| |Y1|) = 1/(δ2 |X2|). Hence,H∞(Xz1) ≥ log(δ2 |X2|). By the property of Extz1 , the distribution defined by Extz1(Xz1 , Y2)over Z2 is ε2-close to uniform.

The total probability according to Ext(X,Y1) on z1 ∈ Z1 whose probability according toExt(X,Y1) is less than (δ2/δ) · (1/ |Z1|) is less than δ2/δ.

By the property of Ext, the distribution defined by Ext(X,Y1) on Z1 is ε1-close to uniform.Overall, we can upper bound the distance of the distribution defined by (Ext⊗Extz)(X,Y1, Y2)

over Z1 × Z2 from uniform by ε1 + δ2/δ + ε2.

Corollary 4.5. Let 0 < ε < 1. Set δ(|F| , k, ε) = |F|−k/2 kk(k + 1)ε−k. Then, for all k′, theincidence graph “degree-k curves vs. k′-tuples” is a (δk′/ε, 2k

′ε)-extractor for

δk′ = (|F| − k′ + 1)−(k−k′+1)/2kk(k + 1)ε−k.

15

Proof. The proof is by induction on k′. For k′ = 1 the claim follows from Proposition 4.2that analyzes the sampling properties of the incidence graph “degree-k curves vs. points” andProposition 2.3 that converts samplers to extractors. Assume that the claim is true for k′ − 1,and let us prove it for k′.

For every (k′ − 1)-tuple of points S ⊆ Fm, consider the “(degree-k curves through S)vs. points” incidence graph, where every curve through S is connected to all the points onit except for those in S. Similarly to Proposition 4.2, this incidence graph is a (δk′ , ε)-extractor.Moreover, for different S’s we get isomorphic incidence graphs.

We can view the incidence graph “degree-k curves vs. k′-tuples” as the product of the inci-dence graph “degree-k curves vs. (k′ − 1)-tuples” and the family of incidence graphs “(degree-kcurves through S) vs. points” for different (k′−1)-tuples S ⊆ Fm. By the induction hypothesis,the first is a (δk′−1/ε, 2(k

′−1)ε)-extractor. Each graph in the second family is a (δk′ , ε)-extractor.By Lemma 4.4 and since δk′ ≥ δk′−1, the product graph is a (δk′/ε, 2k

′ε)-extractor.

Note that the statement of Corollary 4.5 is meaningful for sufficiently large F with respect tok′. For such we can take ε = |F|−Θ(1) and have a deviation 2k′ε = |F|−Θ(1).

Corollary 4.6. There exists a ≥ 1, such that for sufficiently large k ≥ a·k′, for sufficiently large|F| ≥ a ·k, the incidence graph “degree-k curves vs. k′-tuples” is a (|F|−Θ(k) , |F|−Θ(1))-extractor.

Another application of the replacement product that we will need later is to analyzing theincidence graph of “pairs of degree-k curves vs. pairs of points”. One side of this graph containsall pairs of degree-k curves in Fm, while the other side contains all the pairs of points in Fm. Apair of curves is connected to a pair of points if the first curve contains the first point and thesecond curve contains the second point.

Corollary 4.7. The incidence graph “pairs of degree-k curves vs. pairs of points” is a (|F|−Θ(k) , |F|−Θ(1))-extractor.

Proof. This “pairs of degree-k curves vs. pairs of points” graph is the product of the followingincidence graphs:

• “pairs of degree-k curves vs. points”, where a pair of curves is connected to a point on thefirst curve.

• The family of graphs “pairs of degree-k curves where the first curve passes through a pointz vs. points” where z ∈ Fm and a pair of curves, where the first curve must pass throughz, is connected to a point on the second curve.

By Corollary 4.3, both graphs are (|F|−Θ(k) , |F|−Θ(1))-extractors (note that the second curve ofthe pair in the first graph and the first curve of the pair in the second graph do not damage theextractor property). By Lemma 4.4, the product is an (|F|−Θ(k) , |F|−Θ(1))-extractor as well.

5 The Base Low Degree Test

In this section we show that a “robust” low degree testing theorem for Surface-vs.-Surfacefollows from the low degree testing theorem for Line-vs.-Line Test [4].

Lemma 5.1 (Line vs. Line low degree testing theorem [4]). Assume that F is a large enough

field (polynomial size) with respect to d and m. For some δ = |F|−Ω(1), for any prover strategies

16

A1, A2, there are m-variate polynomials p1, . . . , pl, l ≤ O(1/δ), of degree at most d over F, suchthat the probability that the Line-vs.-Line Test passes but A1(ℓ1) is not one of p1|ℓ1 , . . . , pl|ℓ1(similarly for A2(ℓ2)), is at most δ.

Our “robust” low degree testing theorem holds when restricting to surfaces that pass throughgiven k′′ points S ⊆ Fm, and even further when restricting to a sub-family of fraction δ =|F|−Θ(k) of the surfaces that pass through S. We use CS to denote those surfaces in C that passthrough S. The construction relies on the curve-tuple sampling proved in Section 4.

We focus on the following family C of 3-dimensional surfaces in Fm: Fix initial conditions

(xi,1, . . . , xi,q)Mi=1 ⊆ (Fm)q.

For every 1 ≤ i ≤ M , add all the 3-dimensional surfaces of the form

s(t1, t2, t3) = c1(t1) + t3c2(t2),

where c1 is a curve of degree at most q+ k and passes through xi,1, . . . , xi,q, and c2 is a curve ofdegree at most k. The forbidden points Q : C → 2F rule out the initial points embedded in thecurves. The number of curves is M · |F|O((q+k)m). Each surface is the union of |F|2 lines x+ tywhere x ∈ Fm is on the curve c1, and y ∈ Fm is on the curve c2.

Proposition 5.2 (Base test). Assume that F is a large enough field (polynomial size) withrespect to m, d, k and |Q|. Assume that k is large enough (linear size) in k′′. There are

δ = |F|−Ω(k) and ε = |F|−Ω(1) that satisfy:For any C′ ⊆ C and S′ ⊆ Fm, |S′| ≤ k′′, such that

∣∣C′S′

∣∣ ≥ δ |CS′ |,

ListErrC′S′

|F|O(1),d(q+k)(Surface-vs.-Surface Test(C′

S′ , Q,Fm)) ≤ |F|−Ω(1) .

Proof. The proposition is proved by using a successful strategy for Surface-vs.-Surface tosucceed in Line-vs.-Line Test, applying Lemma 5.1 to deduce agreement of the assignmentsto lines with a low degree polynomial, and arguing that this agreement extends to surfaces.

Fix C′ and S′ as in the premise. Fix a strategy for Surface-vs.-Surface Test(C′S′ , Q,Fm).

We use it to devise a strategy for Line-vs.-Line Test as follows. Given a line ℓ = x+ ty | t ∈ Fwhere x is uniformly distributed in Fm and y is uniformly and independently distributed inFm − 0, we consider a uniform surface in C′

S′ of the form s = c1(t1) + t · c2(t2) | t1, t2, t ∈ Fsuch that x ∈ c1(F) and y ∈ c2(F), ℓ ⊆ s−Q. The assignment A(ℓ) is the restriction to ℓ of theassignment to the surface.

By Corollary 4.7, and using that |F| is sufficiently larger than |Q|, the distribution of the sur-

faces picked by the above process during a run of Line-vs.-Line Test is |F|−Θ(1)-close to thedistribution of surfaces in Surface-vs.-Surface Test(C′

S′ , Q,Fm). Hence, except for proba-

bility |F|−Θ(1), Line-vs.-Line Test succeeds whenever Surface-vs.-Surface Test does.

Applying Lemma 5.1, for δ = |F|−Θ(1) there are m-variate polynomials p1, . . . , pl, l ≤ O(1/δ),of degree at most d(q + k) over F, such that the probability that Line-vs.-Line Test passes,yet it picks a line ℓ1 such that A(ℓ1) is not one of p1|ℓ1 , . . . , pl|ℓ1 , is at most δ.

Assume that Surface-vs.-Surface Test passes with probability sufficiently large |F|−Θ(1)

(otherwise we are done). Since |F| is sufficiently large with respect to d, q and k, for a uniformsurface in C′

S′

s = c1(t1) + t · c2(t2) | t1, t2, t ∈ F ,

17

except for probability |F|−Θ(1), for more than d(q + k)l/ |F| fraction of the choices of t1, t2 ∈ F,c2(t2) = 0, on the restriction of s to the line c1(t1) + t · c2(t2) | t ∈ F the assignment A(s)agrees with one of p1|ℓ1 , . . . , pl|ℓ1 . For such s’s it holds that A(s) ∈

p1|s, . . . , pl|s

. The lemma

follows.

6 Setup For Direct Product Theorem

In this section we formally define our direct product theorem, and outline its analysis.The theorem assumes that a test that compares two surfaces on a point has error |F|−Ω(1)

even when restricting to a sub-family of surfaces, and shows that a test that compares twosurfaces on k′ points has error |F|−Ω(k′).

Theorem 6.1 (Direct product for low degree testing). Assume that F is large enough (polyno-mial size) in d′, m, k′, |Q|, and that k is large enough (linear size) in k′. Then, the assumptionabout the base test implies the conclusion about the repeated test:

Base Test: Assume that there exists a constant 0 < β′ < 1 such that for every set S′ ⊆ Fm,|S′| ≤ β′k′, for every C′ ⊆ C, |C′| ≥ |F|−β′k′ |C|, and Q′ : C′ → 2F, |Q′| ≤ |Q|+ β′k′:

ListErrC′S′

|F|−Ω(1),d′(Surface-vs.-Surface Test(C′

S′ , Q′,Fm)) ≤ |F|−Θ(1) .

Product Test: Then, there exists δ = |F|−Ω(k′), such that

ListErrC|F|O(k′),d′

(Surfaces Test(C, Q, I)) ≤ δ.

For simplicity, we prove Theorem 6.1 for curves rather than surfaces. Our arguments readilyextend to surfaces.

The heart of the proof of Theorem 6.1 is an analysis of the two query Curve-vs.-CurveTest. This analysis only gives a guarantee about a tiny portion of all curves in C. We then usethe extra queries in Curves Test and the error correction properties of polynomials to give aguarantee about a sizable portion of C. The analysis consists of the following three parts:

1. Analysis of Curve-vs.-Curve Test (Sections 7, 8 and 9): This is the heart of the

analysis. Use the base test to deduce that success |F|−βk′ in Curve-vs.-Curve Testgives rise to a set S′ of ≈ βk′ points in Fm and a low degree polynomial that agrees with≈ |F|−βk′ fraction of the curves in CS′ (recall that CS′ are the curves in C that containS′). To reduce to the base test we use the sampling properties of the “degree-k curvesvs. k′-tuples of points” incidence graph (this is the Wide Agreement Lemma, which is inSection 8).

2. Weak analysis of Curves Test (Section 10): Use the analysis of Curve-vs.-Curve

Test from the previous item to deduce that success |F|−βk′ in Curves Test gives rise to

a low degree polynomial that agrees with ≈ |F|−βk′ fraction of the k′-tuples of points inFm. Here we use the extra queries of the verifier in Curves Test to go from a structuralconclusion about the assignment to CS′ , a tiny portion of all C, to a structural conclusionabout the assignment to a sizable portion of all k′-tuples of points in Fm.

3. Strong analysis of Curves Test (Section 11): Use the weak analysis of Curves Test

to deduce that success |F|−βk′ in Curves Test gives rise to a low degree polynomial

that agrees with ≈ |F|−βk′ fraction of the curves in C. Here we rely on the list decodingargument in Section 3.3.

18

7 Identifying a Successful Sub-Test

In this section we show that success probability γ ≫ |F|−k′ of Curve-vs.-Curve Test impliesa much higher success probability ≫ 1/ |F| of Curve-vs.-Curve-on-Point Test over a smallsubset of the curves that have some points in common and agree on them. We will later use thislemma where the initial family of curves does not necessarily contain all degree-k curves. Wetherefore use C∗ to denote the initial set of curves, and C to denote the family of all degree-kcurves in Fm.

Lemma 7.1 (Sub-Test Lemma). Suppose that the probability that Curve-vs.-Curve Test(C∗, Q, I)passes is at least 4 |F|−βk′. For any k′′ ≥ 1 if 0 < β′ < 1 satisfies β′ > 8βk′/k′′, then there exist

• S′ ⊆ Fm, |S′| = k′′;∣∣C∗

S′

∣∣ ≥ |F|−βk′ · (|C∗| / |C|) · |CS′ |;

• C′ ⊆ CS′ , |C′| ≥ |F|−βk′ ·∣∣C∗

S′

∣∣;• Q′ : C′ → 2F, |Q′| ≤ |Q|+ k′′;

such that Curve-vs.-Curve-on-Point Test(C′, Q′, IS′) accepts with probability at least (1/2) |F|−β′.

Proof. Pick uniformly c ∈ C∗ and S′ ⊆ c−Q, |S′| = k′′, such that conditioned on Curve-vs.-Curve Test(C∗, Q, I) picking c and S ⊆ c−Q, S ⊇ S′, the test passes with probability at

least |F|−βk′ . Let a1, . . . , ak′′ ∈ F be the assignments of A(c) to the points in S′. Let C′ ⊆ C∗S′

contain all those curves c′ ∈ C∗S′ that assign a1, . . . , ak′′ to the points in S′. We know that

|C′| ≥ |F|−βk′ ·∣∣C∗

S′

∣∣. The probability that∣∣C∗

S′

∣∣ < |F|−βk′ · (|C∗| / |C|) · |CS′ | is at most |F|−βk′ .We’ll show that conditioned on Curve-vs.-Curve Test picking c1, c2 ∈ C′ and S′ ⊆ S ⊆

c−Q1 , c−Q

2 , it holds that A(c1), A(c2) agree on more than |F|−β′fraction of the x ∈ S except

with probability at most |F|−β′k′′/2 over the choice of c, S′, as well as over the randomness inCurve-vs.-Curve Test. Let us call this property “high probability agreement”. If A(c1),

A(c2) agree on at most |F|−β′fraction of the x ∈ S, then – since S′ is uniform inside S –

the probability that S′ falls inside the agreement points is at most |F|−β′k′′ . By Bayes’ law,

and since the probability of agreement on S′ is at least |F|−βk′ , conditioning on agreement on

S′ the probability that A(c1), A(c2) agree on at most |F|−β′fraction of the x ∈ S is at most

|F|−(β′k′′−βk′) ≤ |F|−β′k′′/2.

Fix c and S′ such that∣∣C∗

S′

∣∣ ≥ |F|−βk′ · (|C∗| / |C|) · |CS′ | and high probability agreement holdswhere the probability is only taken over the randomness in the test. Let Q′ inherit the forbiddenpoints of Q in addition to the points of S′.

The distribution D1 of curves and tuples in Curve-vs.-Curve-on-Point Test(C′, Q′, IS′)is different from their distribution D2 in Curve-vs.-Curve Test(C∗, Q, I) conditioned on thecurves being in C′ and tuples falling to IS′ . In particular, D1 may place much of the probabilityon very few tuples that most of their curves fall in C′ (since the probability of a tuple isproportional to square the fraction of its curves that fall into C′), while in D2, assuming thatC′ is large enough, the distribution of tuples is close to uniform over all tuples in IS′ . However,for any event E, the probability of E according to D1 is at most |F|βk

′times its probability

according to D2. In particular, this is true for the event that A(c1), A(c2) agree on more than

|F|−β′fraction of the x ∈ S. Therefore, the probability that Curve-vs.-Curve-on-Point

Test(C′, Q′, IS′) accepts is at least (1/2) |F|−β′.

19

8 From Large Intersection To One Point Intersection

In this section we prove the Wide Agreement Lemma discussed in the introduction. We showthat if the Curve-vs.-Curve-on-Point Test passes with good probability when the intersec-tion between curves contains (k′ − k′′) points, then the Curve-vs.-Curve Test passes withcomparably good probability when the intersection between curves contains just one point. Theproof relies on the sampling property of the “degree-k curves vs. k′-tuples” incidence graph.

Lemma 8.1 (Wide Agreement Lemma). Assume the setup of Lemma 7.1, and in particular thatfor S′, C′ and Q′ as there, the probability that Curve-vs.-Curve-on-Point Test(C′, Q′, IS′)

accepts is at least (1/2) |F|−β′. Further, assume that β and β′ are such that for every (k′′ + 1)-

tuple of points S′′ ⊆ Fm, the incidence graph G(CS′′ , IS′′) is (δ, ε)-sampling for

ε ≤ (1/12) · |F|−β′.

δ ≤ ζ2 |F|−2βk′ (|C∗| / |C|)ε2,

Then, Curve-vs.-Curve Test(C′, Q′,Fm) passes with probability at least (1/2) |F|−β′− 3ε.

Proof. For a point x ∈ Fm let CS′∪x be the curves c ∈ CS′ such that x ∈ c−Q′, and let IS′∪x

be the tuples in IS′ that pass through x. Since S′ is fixed throughout the proof, we use Cx todenote CS′∪x and we use Ix to denote IS′∪x.

Let p(x) be the probability that a uniform c ∈ C′ contains x as x ∈ c−Q′. For a possible

assignment a ∈ F to x, let Cx,a be the family of curves in Cx with A(c)(x) = a. Per S ∈ IS′ ,let µx,a(S) be the fraction of curves in Cx,a among the curves in C′ ∩ Cx that contain S. Sinceevery curve c ∈ C′ ∩ Cx contains the same number of k′-tuples in Ix,

ES∈Ix

[µx,a(S)] =|C′ ∩ Cx,a||C′ ∩ Cx|

.

The probability that Curve-vs.-Curve Test(C′, Q′,Fm) passes is given by

∑x∈Fm

p(x) ·∑a∈F

(|C′ ∩ Cx,a||C′ ∩ Cx|

)2

. (2)

The probability that Curve-vs.-Curve-on-Point Test(C′, Q′, I) passes is given by∑x∈Fm

p(x) ·∑a∈F

∑c∈C′∩Cx,a

1

|C′ ∩ Cx|· ES∈Ix:S⊆c

[µx,a(S)]. (3)

By the sampling property of “degree-k curves vs. (k′ + 1)-tuples”, all curves c ∈ Cx, exceptfor at most δ |Cx| curves which we denote Bx, have

ES∈Ix:S⊆c

[µx,a(S)] =|C′ ∩ Cx,a||C′ ∩ Cx|

± ε.

Let G ⊆ Fm be the points x ∈ Fm for which |C′ ∩ Cx| > (δ/ε) |Cx|. Since |C′| ≥ (δ/ε2) |CS′ |,for x /∈ G it holds:

p(x) =|C′ ∩ Cx|

|C′|≤ δ

ε

|Cx||C′|

≤ δ

ε

|Cx|(δ/ε2) |CS′ |

= ε|Cx||CS′ |

.

20

Hence, the contribution to (3) from points x /∈ G is at most∑x∈Fm

ε|Cx||CS′ |

≤ ε.

The contribution to (3) from points x ∈ G and curves c ∈ Bx is at most∑x∈G

p(x) · |C′ ∩ Cx ∩Bx||C′ ∩ Cx|

≤∑x∈G

p(x) · δ |Cx|(δ/ε) |Cx|

≤ ε.

Hence, we can upper bound the probability in (3) by:

(3) ≤ 2ε+∑x∈G

p(x) ·∑a∈F

∑c∈C′∩Cx,a−Bx

1

|C′ ∩ Cx|· ES∈Ix:S⊆c

[µx,a(S)]

≤ 2ε+∑x∈G

p(x) ·∑a∈F

∑c∈C′∩Cx,a

1

|C′ ∩ Cx|·(|C′ ∩ Cx,a||C′ ∩ Cx|

+ ε

)

≤ 3ε+∑x∈Fm

p(x) ·∑a∈F

(|C′ ∩ Cx,a||C′ ∩ Cx|

)2

The lemma follows from (2).

9 Curve vs. Curve Analysis

In this section we apply the machinery we developed to this point, as well as the guaranteeabout the base test, to start from a noticeable success probability of Curve-vs.-Curve Testand get a small set of points and a low degree polynomial that agrees with a noticeable fractionof the curves through the points.

Lemma 9.1 (Analysis of Curve-vs.-Curve Test). Assume that |F| is a sufficiently largepolynomial of d, m, k. Let 0 < β′ < β < 1.

Base Test: Let C′ ⊆ C be such that for every β′k′-tuple of points S′ ⊆ Fm where∣∣C′

S′

∣∣ ≥δ |CS′ |, for every Q′ : C′ → 2F, |Q′| ≤ q:

AgrErrC′

γ→γ′,d→d′(Curve-vs.-Curve Test(C′, Q′,Fm)) ≤ γ0.

Assumptions:

•γ0 ≤ (1/4) · |F|−β′

,

• For every S′′ ⊆ Fm, |S′′| ≤ β′k′ +1, the incidence graph G(CS′′ , IS′′) is (δ, ε)-sampling forδ and ε as in Lemma 8.1.

Repeated Test: If Curve-vs.-Curve Test(C∗, Q, I) passes with probability at least 4 |F|−βk′ ,then there exists a set S′ ⊆ Fm, |S′| ≤ β′k′ and an m-variate polynomial of degree at most d′

over F that agrees with at least γ′((1/4) · |F|−β′) · |F|−2βk′ (|C∗| / |C|) |CS′ | fraction of the curves

in C∗S′.

21

Proof. Assume thatCurve-vs.-Curve Test(C∗, Q, I) passes with probability at least 4 |F|−βk′ .Let 0 < β′ < β and k′′ < β′k′ be as in Lemma 7.1. By Lemma 7.1, there exist S′ ∈ (Fm)k

′′;

C′ ⊆ CS′ ; Q′ : C′ → 2F; such that |C′| =∣∣C′

S′

∣∣ ≥ |F|−2βk′ (|C∗| / |C|) |CS′ |, and the probability that

Curve-vs.-Curve-on-Point Test(C′, Q′, IS′) passes is at least (1/2) |F|−β′. By Lemma 8.1,

Curve-vs.-Curve Test(C′, Q′,Fm) passes with probability at least (1/4) · |F|−β′. By our

assumption on the base test, there is an m-variate polynomial p of degree at most d′ over F thatagrees with a set of curves Cp of fraction γ′ = γ′((1/4) · |F|−β′

) in C′. We have

|Cp| ≥ γ′∣∣C′∣∣ ≥ γ′ |F|−2βk′ (|C∗| / |C|) |CS′ | .

10 Curves Test Analysis

In this section we use the analysis of Curve-vs.-Curve Test in Section 9 to derive an analogousconclusion for Curves Test. Thanks to the third query in Curves Test, this time we get aconclusion about the agreement of a low degree polynomial with a large portion of all k′-tuples,not just those that contain a small set S′ of points. In the next sections we will extend this toargue about agreement with a large portion of all curves.

Lemma 10.1 (Analysis of Curves Test). Using the notation of Lemma 9.1, and under itsassumptions about the parameters and the base test:

Repeated Test:

AgrErrIγ→|F|−Ω(k′),d→d′

(Curves Test(C, Q, I)) ≤ 2 |F|−βk′ .

Proof. Assume that Curves Test(C, Q, I) passes with probability at least 2 |F|−βk′ . Let C∗

be the family of curves c ∈ C, such that with probability at least |F|−βk′ over the choice of

S ⊆ c−Q, it holds that A(c) and A(S) agree. We have |C∗| ≥ |F|−βk′ |C|, and Curve-vs.-

Curve Test(C∗, Q, I) passes with probability at least |F|−βk′ .By Lemma 9.1, there exists an m-variate polynomial p of degree at most d′ over F, such that

with probability at least γ′((1/4)·|F|−β′)·|F|−3βk′ |CS′ | over c ∈ C∗

S′ , it holds that A(c) ≡ p|c. Thelemma follows since every k′-tuple that does not intersect S′ is contained in the same numberof curves in CS′ , which means that A(c2) agrees with at least |F|−βk′ fraction of the S2’s.

11 Concluding The Analysis

In this section we get a list of polynomials that explains almost all of the success of CurvesTest.

Lemma 11.1 (decoding → list decoding). Under the assumptions of Lemma 10.1, there exists

δ0 = |F|−Ω(k′), such that

ListErrC2/δ0,dk(Curves Test(C, Q, I)) ≤ δ0.

Proof. By Lemma 10.1 and the list decoding transformation of Lemma 3.2.

22

From the list decoding that explains the success of assignments to tuples we can get a listdecoding that explains that success of assignments to curves:

Lemma 11.2. Using the assumptions and notation of Lemma 11.1, and assuming that6 (δ3/20 /2)·(|F|−|Q|

k′

)>

(dkk′

),

ListErrC2/δ0,dk(Curves Test(C, Q, I)) ≤ δ0.

Proof. For c1, S1, c2, S2, c3 picked in Curves Test, we set:

• AGR: A(c3)|S2≡ A(S2);

• TEXPi: A(S2) ≡ pi|S2;

• TEXP :∨l

i=1 TEXPi;

• CEXPi: A(c3) ≡ pi|c3 ;

• CEXP :∨l

i=1CEXPi;

By Lemma 11.1,Pr [AGR ∧ ¬TEXP ] ≤ δ.

Hence,

Prc3

[PrS2

[AGR ∧ ¬TEXP ] ≥√δ

]≤

√δ.

Consider a curve c3 such that PrS2 [AGR ∧ TEXP ] ≥√δ. Then, there exists 1 ≤ i ≤ l, such

that PrS2 [TEXPi] ≥√δ/l. Since the premise of the lemma guarantees that

√δ/l fraction of

the tuples on a curve must span more than dk points, we have CEXPi. Hence,

Pr [AGR ∧ ¬CEXP ] ≤ Pr

[AGR ∧ Pr

S2

[AGR ∧ TEXP ] <√δ

]≤ Pr

[AGR ∧ (Pr

S2

[AGR] < 2√δ)

]+ Pr

[PrS2

[AGR ∧ ¬TEXP ] ≥√δ

]≤ 2

√δ +

√δ.

Putting together Lemma 11.2, appropriately adjusted to surfaces, and Proposition 5.2 es-tablishing the base test, Theorems 3.1 and 1.1 follow. The proof of Theorem 1.2, establishinga property testing algorithm based on Surfaces Test, follows as well. Given a functionf : Fm → F to be tested for low degree, the algorithm invokes Surfaces Test, queries theevaluations of f on the points contained in surfaces picked by Surfaces Test, and checkswhether they correspond to assignments that would have passed the test. If f is a polynomialof degree at most d, then the algorithm always accepts. Suppose that the test accepts withsufficiently large probability |F|−Θ(k). Then, as we saw, the restriction of f to |F|−Θ(k) fractionof the surfaces is consistent with some low degree polynomial. By Corollary 4.3 adapted tosurfaces (and provided that the fraction |F|−Θ(k) is sufficiently large), f must agree with the

polynomial on 1− |F|−Ω(1) fraction of the points.

6When considering v-dimensional surfaces rather than curves, the condition becomes (δ3/20 /2) ·

(|F|−|Q|k′

)>(

dk|F|v−1

k′

).

23

12 From Derandomized Low Degree Test to Sliding Scale Con-jecture

12.1 Preliminaries on Probabilistically Checkable Proofs

A PCP verifier is an NP verifier that has polynomially many tests, each depending on a boundednumber of queries to the proof. A random test (even though it involves only a bounded numberof queries!) predicts correctly the outcome of the verification with good probability.

Definition 12.1 (PCP verifier). For c, s, r, q,Σ that are functions of n, the class PCPc,s[r, q]Σcontains all languages L that have verifiers that on input x of size n use r random bits to makeq queries to a proof over alphabet Σ, and satisfy:

• Completeness: For every x ∈ L, there exists a proof π such that the verifier accepts withprobability at least c.

• Soundness: For every x /∈ L, for any purported proof π, the verifier accepts with probabilityat most s.

Σ is called the alphabet of the proof. It Σ is omitted, the understanding is that Σ = 0, 1.Often we only specify the size of Σ, in which case it is understood that Σ = 1, . . . , |Σ|. Thesize of the PCP (equivalently, the proof length) can be bounded by 2rq. If on inputs x of size nwe have 2rq = n1+o(1)poly(1/ε), then we say that the PCP is of almost linear size. If c = 1 wesay that the verifier has perfect completeness. In this work we will only consider verifiers withperfect completeness. The fraction s is called the soundness error of the verifier, or simply theerror. We have the following lower bounds on the error:

Proposition 12.1. If s < 2−r or s < |Σ|−q, then PCPc,s[r, q]|Σ| ⊆ P .

In other words, for r = O(log n) the error can be at best polynomially small in n, and toachieve error s with a constant number of queries, one has to take the alphabet to be at least(1/s)Ω(1).

Given a PCP verifier, one can generate a new PCP verifier with lower error and more queriesby sequentially repeating the test of the original verifier. The new verifier can be implementedin a randomness-efficient manner, yielding the following:

Proposition 12.2 (Sequential repetition). For every ε = ε(n) > 0, there is k = Θ(log1/s(1/ε)),such that

PCP1,s[r, q]|Σ| ⊆ PCP1,ε[O(r + k), qk]|Σ|.

We say that a PCP verifier is a projection PCP verifier (or that the PCP is a projection game)if the verifier makes q = 2 queries, and given the answer to the first query, there is at most oneaccepting answer to the second query.

A different perspective on PCP verifiers is given by the notion of multi-prover interactiveproofs or multi-prover games:

Definition 12.2 (MIP). We say that a language L has an MIP protocol with parametersc, s, r, q,Σ, if there is a protocol in which a verifier interacts with q non-interacting provers,uses r random bits to decide on queries to the q provers; the provers respond with replies takenfrom an alphabet Σ.

24

• Completeness: For every x ∈ L, there exists a strategy to the provers such that the verifieraccepts with probability at least c.

• Soundness: For every x /∈ L, for any strategy to the provers, the verifier accepts withprobability at most s.

One can view any MIP protocol as a PCP verifier, and vice versa. The proof for the PCPverifier consists of writing down, for each of the MIP’s protocol q provers, its replies on all thepossible questions of the verifier.

The PCP Theorem states that probabilistic checking of proofs can always be done withconstant number of queries:

Theorem 12.1 (PCP Theorem [6, 5, 3, 2]). NP ⊆ PCP1, 12[O(log n), O(1)].

Various works amplify the soundness error of the basic PCP theorem. We will use a PCPtheorem with low error:

Theorem 12.2 (Low error PCP Theorem [29, 4, 12]).

NP ⊆ PCP1,2/|Σ| [O(log n), O(1)]|Σ| ,where log |Σ| =√log n log log n.

12.2 From Derandomized Low Degree Test to Sliding Scale Conjecture

In this section we show how a derandomized low degree test as in Conjecture 3.1 implies theSliding Scale Conjecture, hence proving Theorem 1.3. The idea of the proof is to use the lowdegree test for simulating sequential repetition. This idea has been used in many works before,however, there are a few differences between the current proof and previous works: (1) We startwith a low error PCP by Dinur et al [12], and our choice of parameters is unusual; (2) Weformulate and use a new abstraction of the composition theorem of Arora-Safra [3].

Our construction is as follow. We start with an instantiation of the low error PCP fromTheorem 12.2:

NP ⊆ PCP1,2/|Σ| [O(log n), O(1)]|Σ| ,where log |Σ| =√log n log log n.

By sequential repetition of this PCP O(√

log n/ log log n) times (see Proposition 12.2) we get:

NP ⊆ PCP1,1/n

[O(log n), O(

√log n/ log log n)

]|Σ|

.

We wish to decrease the number of queries to a constant without hurting the soundness error orthe randomness too much. Recall that to allow that we have to increase the alphabet appropri-ately (see Proposition 12.1). Ultimately, we want to prove a PCP theorem with polynomiallysmall error and polynomial alphabet size:

NP ⊆ PCP1,1/nΩ(1) [O(log n), O(1)]nO(1) . (4)

From this, one can get “sliding-scale”, i.e., error ε with alphabet size poly(1/ε) by compositionwith a Hadamard/quadratic functions-based construction.

In the next section we describe the algebraic framework for converting a PCP verifier withmany queries to a PCP verifier with a constant number of queries based on the local testingand decoding properties of low degree polynomials. This framework is invoked twice, with two

25

different settings of parameters. In the first application (see Section 12.3), we get a constructionwith sub-exponential alphabet (v is a constant):

NP ⊆ PCP1,1/nΩ(1) [O(log n), O(1)]22

Θ((logn)1/2v) . (5)

In the second application (see Section 12.4), we get a construction7 with poly-logarithmic ran-domness, poly-logarithmically small soundness error, and quasi-polynomial alphabet:

NP ⊆ PCP1,2−Ω(log2v n)

[O((log n)4v−1), O(1)

]2Θ(log4v−1 n) . (6)

Our final construction (4) is obtained from composing (5) as an outer construction and (6) asinner construction. The idea is that construction (6) is invoked on n′ which is about logarithmic

in the alphabet size of (5), i.e., n′ = 2Θ((logn)1/2v), so (log n′)2v = O(log n). The final constructioninherits its soundness error from both the outer and inner constructions, but inherits its alphabetonly from the inner construction.

12.3 Query Reduction Using Polynomials

We assume a PCP verifier V1 that uses r random bits to make q queries to a proof over alphabetΣ. The verifier has perfect completeness and soundness error ε. We show how to simulate V1

using a new verifier V2 that makes only O(1) queries to a proof over a larger alphabet.The general idea is this: The proof for V2 contains a (supposed) encoding of V1’s proof as a

low degree polynomial. The encoding is given by the restrictions of the polynomial to curvesand tuples of points. Each curve goes through q points that represent q queries of V1 on somerandomness string. The verifier V2 locally tests the encoding by making only O(1) queries usingthe low degree test, and achieves low soundness error. The verifier V2 locally decodes the qqueries required for V1 by making a single query to a curve.

The details are as follows: Let N = 2rq be the maximal length of a proof accessible by averifier with 2r possible tests, each accessing q locations in the proof. Let m, h be naturalnumbers for which hm = N . Denote d

.= m(h− 1). Let F be a finite field of characteristic two

and size |F| ≥ poly(d, |Σ|) for a sufficiently large polynomial as in Conjecture 3.1. Let H ⊆ F,|H| = h, and associate 1, . . . , N with Hm. Let S ⊆ F, |S| = |Σ|, and associate Σ with S.

For a string π ∈ ΣN , let pπ : Fm → F be the m-variate polynomial of degree at most h− 1 ineach of its variables for which pπ(x) = π(x) for every x ∈ Hm.

For randomness w ∈ 0, 1r, let (xw,1, . . . , xw,q) ∈ (Hm)q be the q-tuple of points correspond-ing to the queries of V1 on randomness w. Let C be a family of v-dimensional surfaces that passthrough (xw,1, . . . , xw,q)w as discussed in Section 5.

The verifier V2 is as follows:

Verifier V2

Prescribed proof: As specified by the low degree test; supposedly the restrictions of pπ to curvesin C and k′-tuples in I.Test:

1. Simulate the verifier of the low degree test; let xw,1, . . . , xw,q ∈ Fm be the initial pointspicked by the verifier (embedded in a curve). Reject if the low degree testing verifierrejects.

7In fact, as we explain in Section 12.4, we need a stronger guarantee, namely a “decoding verifier”.

26

2. Let v1, . . . , vq ∈ F be the evaluations received on xw,1, . . . , xw,q (embedded in the assign-ment for the curve).

3. Reject if it is not the case that v1, . . . , vq ∈ S.

4. Apply V1 on randomness w and answers v1, . . . , vq. Reject if V1 rejects; accept otherwise.

The verifier V2 uses O(log |C|) random bits to make O(1) queries to a proof over alphabet F(d′+v

v ).It has perfect completeness. It remains to prove soundness.

Lemma 12.3 (PCP Soundness). There are γ, γ′ = |F|−Ω(k′) for which: if there is a proof thatmakes V2 accept with probability more than γ′, then there is a proof that makes V1 accept withprobability more than γ.

Proof. Assume on way of contradiction that there is no proof that makes V1 accept with proba-bility more than γ (to be fixed later). Apply the soundness of the low degree test for an appro-

priate parameter ε = |F|−Ω(k′), and let p1, . . . , pl be the polynomials list decoding, l = |F|O(k′).Let π1, . . . , πl be the proofs that correspond to p1, . . . , pl: For every i ∈ 1, . . . , N, the i’thposition of πj is pj(i) if pj(i) ∈ S, and an arbitrary symbol otherwise (Recall that we associate1, . . . , N with Hm).

There are two cases in which V2 accepts:

1. The low degree test passes although it is not the case that v1 = pi(xw,1), . . . , vq = pi(xw,q)for some 1 ≤ i ≤ l. By the low degree test soundness guarantee, this happens withprobability at most ε.

2. v1 = pi(xw,1), . . . , vq = pi(xw,q) for some 1 ≤ i ≤ l, and v1, . . . , vq ∈ S, and V1 acceptsπi on randomness w. By the soundness of V1, for every 1 ≤ i ≤ l, this happens withprobability at most γ. Thus, the probability it happens for some 1 ≤ i ≤ l is at most lγ.

This means that V2 accepts with probability at most ε+ lγ. Pick γ = |F|−Ω(k′) so γ′.= ε+ lγ =

|F|−Ω(k′).

Settings of Parameters (toward (5)):

• m, k′, q, k = Θ((log n)1−1/2v).

• h, |F| = 2Θ((logn)1/2v).

• |Fm| = nΘ(1).

• |F|−Ω(k′) = 1/nΩ(1).

• |Σ| = 22Θ((logn)1/2v)

.

• |C| ≤ nO(1).

27

12.4 Decoding verifier

We can adapt the algebraic construction from the previous section into a “decoding” verifier,i.e., a verifier that, if it does not reject, outputs symbols from a list decoding of proofs. Thisvariant is required for the composition scheme:

Definition 12.3 (Decoding verifier). We say that a verifier V is a decoding verifier with errorprobability ε and list size l for SatN , if the following holds: On input a formula φ on N variables,and a collection of u-tuples of variables,

• Completeness: For every assignment π that satisfies φ, there is a proof that V neverrejects. Moreover, given access to this proof, V outputs (xi1 , v1), . . . , (xiu , vu), where(xi1 , . . . , xiu) is uniformly distributed u-tuple from the given collection, and v1 = π(xi1), . . . , vu =π(xiu).

• Soundness: For every proof for V , there are assignments π1, . . . , πl that satisfy φ, suchthat the probability that V does not reject and outputs (xi1 , v1), . . . , (xiu , vu), so none ofπ1, . . . , πl satisfies v1 = π(xi1), . . . , vu = π(xiu), is at most ε.

For a large enough (polynomial size) field F with respect to q, one can obtain a decoding

verifier with error |F|−Ω(1) and list size |F|O(1) from the standard Sum-Check construction andthe Line-vs.-Line Test [23]. Applying our query reduction technique on this decoding verifier,

one obtains a decoding verifier with error probability |F|−Ω(k′) and list size |F|O(k′).

Setting of parameters (toward (6)):

• m =√log n.

• h, |F| = 2Θ(√logn).

• u = Θ(1).

• k′, k, q = Θ((log n)2v−1/2).

• |Fm| = poly(n).

• |F|Θ(k′) = 2Θ((logn)2v).

• |Σ| ≤ 2O(√logn).

• |C| ≤ 2O((logn)2v)poly(M).

12.5 Composition

Using a PCP verifier with low error ε but large alphabet Σ, and a decoding verifier for input sizen′ ≈ log |Σ| with low error ε and small alphabet Σ′, one can obtain a PCP verifier with errorO(ε) and alphabet Σ′. The technique, called composition, was first introduced by Arora andSafra in their breakthrough PCP paper [3]. The next lemma describes an abstract interpretationof the Arora-Safra composition.

Interestingly, while this composition lemma is in the same spirit as the combinatorial compo-sition lemmas of Szegedy [32], Dinur-Reingold [15], Ben-Sasson et al [8] and Dinur-Harsha [14](which is an abstraction of the composition of the author and Raz [28]), it differs from them

28

in its parameters and in its requirements from the initial verifiers. It preserves low error likethe composition lemma of [14], but it does not require the initial verifiers to be robust. Itsdisadvantage is that the number of queries increases and (naturally) the output verifier is notrobust.

We compose a verifier and a decoding verifier as follows. Let Vout be a PCP verifier for Satn

that uses r1 random bits to make q1 queries to a proof over alphabet Σ1 and achieves perfectcompleteness and soundness error ε1. Let C be an error correcting code for encoding symbolsfrom Σ1, whose parameters are (n′, log |Σ1| , (1− ε2/4)n′)S as in Proposition 2.1. For every ran-domness w ∈ 0, 1r1 , consider the formula φw over variables x1,1, . . . , x1,n′ , · · · , xq1,1, . . . , xq1,n′ ,each ranging over S, such that φw is satisfied iff the variables correspond to C(v1), . . . , C(vq1)where v1, . . . , vq1 ∈ S are values that would make Vout accept on randomness w. Consider the

collection of q1-tuples (x1,i, . . . , xq1,i)n′

i=1. Suppose that for all w ∈ 0, 1r1 , on input φw andthe collection we defined, a decoding verifier Vin uses r2 random bits to make q2 queries to aproof over alphabet Σ2 and achieves error probability ε2 with list size l2. Note that with thespecified initial points, the verifier Vin decodes a uniformly random symbol i ∈ [n′] from eachof the q1 encodings of the queries of Vout on randomness w.

The composed verifier is as follows:

Verifier V

Prescribed proof:

• A proof π1 for Vout written over the alphabet S, where each symbol in Σ1 is encoded usingC. We denote the length of π1 by N1.

• Per random string w ∈ 0, 1r1 , the prescribed proof πw of Vin for the formula φw, thecollection of q1-tuples we defined above, and the satisfying assignment corresponding toπ1.

1. Pick uniformly at random w1 ∈ 0, 1r1 .

2. Simulate Vin on πw1 . If Vin rejects, reject. Otherwise, Vin decodes q1 symbols v1, . . . , vq1 ∈S that are supposed to equal certain symbols in π1. If they are not equal, reject.

3. If none of the tests above rejects, accept.

In the lemma below we analyze the composed verifier. Note that we think of q1, q2 that areconstants.

Lemma 12.4 (Composition). Suppose that ε1/q12 (1− ε2)/l2 ≥ 2ε

1/q11 and that ε ≤ 2(ε1/ε2)

1/q1.The composed verifier uses r1 + r2 random bits to make q1 + q2 queries to a proof over alphabetΣ2 and achieves perfect completeness and soundness error O(ε2).

Proof. Without loss of generality, we assume that every symbol of π1 is accessed by Vout withthe same probability.

The randomness, number of queries, alphabet and perfect completeness of V are evident. Letus argue soundness. Assume that V accepts with probability at least 2ε2. We will argue thatthere exists a proof for Vout that makes it accept with probability at least ε1.

For every i ∈ [N1], pick uniformly at random a symbol σ ∈ Σ1 among the ones whose encodingagrees with π1(i) on at least ε fraction. By Johnson’s bound (see Proposition 2.2), there are

29

at most 2/ε such symbols. We will argue that the expected probability that Vout accepts is atleast ε1. It will follow that there exists a proof with success probability at least ε1.

For at least ε2 fraction of the choices of w1, with probability at least ε2, the verifier Vin

accepts the proof πw1 and decodes q1 symbols from π1, one per query of Vout on randomness w1.By the soundness of Vin, for all those w1’s, there must exist πw1,1, . . . , πw1,l2 ∈ Sn′

that satisfyφw1 , and, with probability at least 1 − ε2, the proof π1 agrees with one of πw1,1, . . . , πw1,l2 onthe q1 S-symbols Vin decodes. Hence, there must be 1 ≤ p ≤ l2 such that πw1,p agrees with π1on at least (1 − ε2)/l2 ≥ ε fraction of S-symbols from each one of the q1 symbols Vout querieson randomness w1. The probability that all q1 symbols in Vout’s probabilistic proof agree withπw1,p is at least εq1 . Thus, the expected fraction of w1’s for which Vout accepts is at leastε2 · εq1 ≥ ε1.

By composing the verifier from Section 12.3 and the decoding verifier from Section 12.4, weget Theorem 1.3.

13 Further Research

We hope that the approach for proving the Sliding Scale Conjecture suggested in this paperwill eventually result in a proof of the conjecture. This would follow from a more randomness-efficient tester, either for low degree polynomials or for a modified code (e.g., “folded” low degreeextension or some enhanced polynomial encoding such as multiplicity code). Any approach thatworks by amplification of error is subject to limitations as in [18, 26].

Acknowledgements

Dana Moshkovitz is thankful to Uri Feige, Ariel Gabizon, Shafi Goldwasser, Praladh Harsha,Sanjeev Khanna, Madhu Sudan, Ran Raz, Ronen Shaltiel, Chris Umans, Salil Vadhan, AviWigderson and Henry Yuen for extremely helpful discussions at various stages of this work.

References

[1] N. Alon, J. Bruck, J. Naor, M. Naor, and R. Roth. Construction of asymptotically good,low-rate error-correcting codes through pseudo-random graphs. IEEE Transactions onInformation Theory, 38:509–516, 1992.

[2] S. Arora, C. Lund, R. Motwani, M. Sudan, and M. Szegedy. Proof verification and thehardness of approximation problems. Journal of the ACM, 45(3):501–555, 1998.

[3] S. Arora and S. Safra. Probabilistic checking of proofs: a new characterization of NP.Journal of the ACM, 45(1):70–122, 1998.

[4] S. Arora and M. Sudan. Improved low-degree testing and its applications. Combinatorica,23(3):365–426, 2003.

[5] L. Babai, L. Fortnow, L. A. Levin, and M. Szegedy. Checking computations in polyloga-rithmic time. In Proc. 23rd ACM Symp. on Theory of Computing, pages 21–32, 1991.

30

[6] L. Babai, L. Fortnow, and C. Lund. Nondeterministic exponential time has two-proverinteractive protocols. Computational Complexity, 1:3–40, 1991.

[7] M. Bellare, S. Goldwasser, C. Lund, and A. Russell. Efficient probabilistically checkableproofs and applications to approximations. In Proc. 25th ACM Symp. on Theory of Com-puting, pages 294–304, 1993.

[8] E. Ben-Sasson, O. Goldreich, P. Harsha, M. Sudan, and S. Vadhan. Robust PCPs of prox-imity, shorter PCPs, and applications to coding. SIAM Journal on Computing, 36(4):889–974, 2006.

[9] E. Ben-Sasson, M. Sudan, S. P. Vadhan, and A. Wigderson. Randomness-efficient lowdegree tests and short PCPs via epsilon-biased sets. In Proc. 34th ACM Symp. on Theoryof Computing, pages 612–621, 2003.

[10] M. Braverman and A. Garg. Small value parallel repetition for general games. In Proc.48th ACM Symp. on Theory of Computing, pages 335–340, 2015.

[11] M. R. Capalbo, O. Reingold, S. P. Vadhan, and A. Wigderson. Randomness conductorsand constant-degree lossless expanders. In IEEE Conference on Computational Complexity,page 15, 2002.

[12] I. Dinur, E. Fischer, G. Kindler, R. Raz, and S. Safra. PCP characterizations of NP:Toward a polynomially-small error-probability. Computational Complexity, 20(3):413–504,2011.

[13] I. Dinur and E. Goldenberg. Locally testing direct product in the low error range. In Proc.49th IEEE Symp. on Foundations of Computer Science, pages 613–622, 2008.

[14] I. Dinur and P. Harsha. Composition of low-error 2-query PCPs using decodable PCPs.In Proc. 50th IEEE Symp. on Foundations of Computer Science, pages 472–481, 2009.

[15] I. Dinur and O. Reingold. Assignment testers: Towards a combinatorial proof of the PCPtheorem. SIAM Journal on Computing, 36(4):975–1024, 2006.

[16] I. Dinur and D. Steurer. Analytical approach to parallel repetition. In Proc. 47th ACMSymp. on Theory of Computing, 2014.

[17] I. Dinur and D. Steurer. Direct product testing. In Computational Complexity Conference,2014.

[18] U. Feige and J. Kilian. Impossibility results for recycling random bits in two-prover proofsystems. In Proc. 27th ACM Symp. on Theory of Computing, pages 457–468, 1995.

[19] P. Gemmell, R. J. Lipton, R. Rubinfeld, M. Sudan, and A. Wigderson. Self-testing/correcting for polynomials and for approximate functions. In Proc. 23rd ACMSymp. on Theory of Computing, pages 32–42, 1991.

[20] O. Goldreich and S. Safra. A combinatorial consistency lemma with application to provingthe PCP theorem. SIAM J. Comput., 29(4):1132–1154, 2000.

[21] R. Impagliazzo, V. Kabanets, and A. Wigderson. New direct-product testers and 2-queryPCPs. SIAM Journal on Computing, 41(6):1722–1768, 2012.

31

[22] S. M. Johnson. A new upper bound for error-correcting codes. IRE Transactions onInformation Theory, pages 203–207, 1962.

[23] D. Moshkovitz. Lecture notes in probabilistically checkable proofs. Available on the author’swebpage.

[24] D. Moshkovitz. An approach to the sliding scale conjecture via parallel repetition for lowdegree testing. Technical Report 30, ECCC, 2014.

[25] D. Moshkovitz. Parallel repetition from fortification. In Proc. 55th IEEE Symp. on Foun-dations of Computer Science, 2014.

[26] D. Moshkovitz, G. Ramnarayan, and H. Yuen. A no-go theorem for derandomized parallelrepetition: Beyond feige-kilian, 2015.

[27] D. Moshkovitz and R. Raz. Sub-constant error low degree test of almost-linear size. SIAMJournal on Computing, 38(1):140–180, 2008.

[28] D. Moshkovitz and R. Raz. Two query PCP with sub-constant error. Journal of the ACM,57(5), 2010.

[29] R. Raz and S. Safra. A sub-constant error-probability low-degree test and a sub-constanterror-probability PCP characterization of NP. In Proc. 29th ACM Symp. on Theory ofComputing, pages 475–484, 1997.

[30] O. Reingold, S. P. Vadhan, and A. Wigderson. Entropy waves, the zig-zag graph product,and new constant-degree expanders and extractors. Annals of Mathematics, 155(1):157–187, 2002.

[31] R. Rubinfeld and M. Sudan. Robust characterizations of polynomials with applications toprogram testing. SIAM Journal on Computing, 25(2):252–271, 1996.

[32] M. Szegedy. Many-valued logics and holographic proofs. In J. Weidermann, P. vanEmde Boas, and M. Nielsen, editors, Automata, Languages and Programming, 26th In-ternational Colloquium, ICALP 2007. Lecture notes in Computer Science, pages 676–686.Springer-Verlag, 1999.

[33] A. Wigderson and D. Zuckerman. Expanders that beat the eigenvalue bound: Explicitconstruction and applications. Combinatorica, 19:245–251, 1993.

[34] D. Zuckerman. Randomness-optimal oblivious sampling. Random Structures and Algo-rithms, 11(4):345–367, 1997.

32